Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Debian libnss3 adds and updates trusted certificates
published 8 months ago
Summary
The Debian packages libnss3, libnss3-dev, and libnss3-tools now include an updated list of trusted root certificates and several new ones. This change helps ensure that software using these libraries can correctly verify the identity of secure websites and services. Apply the latest package updates to keep your systems using the most current trusted certificates.
What to do
- Update debian libnss3 to version 2:3.42.1-1+deb10u8+tuxcare.els1.
- Update debian libnss3-dev to version 2:3.42.1-1+deb10u8+tuxcare.els1.
- Update debian libnss3-tools to version 2:3.42.1-1+deb10u8+tuxcare.els1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Debian:10 | debian | libnss3 |
< 2:3.42.1-1+deb10u8+tuxcare.els1 Fix: upgrade to 2:3.42.1-1+deb10u8+tuxcare.els1
|
| TuxCare:Debian:10 | debian | libnss3-dev |
< 2:3.42.1-1+deb10u8+tuxcare.els1 Fix: upgrade to 2:3.42.1-1+deb10u8+tuxcare.els1
|
| TuxCare:Debian:10 | debian | libnss3-tools |
< 2:3.42.1-1+deb10u8+tuxcare.els1 Fix: upgrade to 2:3.42.1-1+deb10u8+tuxcare.els1
|
Original advisory text
Update of nss
* Update ca-certificates database to 20260129:
- mozilla\{certdata.h,nssckbi.h}: Update Mozilla certificate
authority bundle of the version 2.82.
- The following certificates were updated:
# Certificate "GlobalSign Root CA"
# Certificate "Entrust.net Premium 2048 Secure Server CA"
# Certificate "Comodo AAA Services root"
# Certificate "XRamp Global CA Root"
# Certificate "Go Daddy Class 2 CA"
# Certificate "Starfield Class 2 CA"
# Certificate "OISTE WISeKey Global Root GA CA"
# Certificate "certSIGN ROOT CA"
# Certificate "ACCVRAIZ1"
# Certificate "Staat der Nederlanden Root CA - G3"
# Certificate "OISTE WISeKey Global Root GC CA"
- The following certificates were added:
# Certificate "emSign Root CA - G1"
# Certificate "emSign ECC Root CA - G3"
# Certificate "emSign Root CA - C1"
# Certificate "emSign ECC Root CA - C3"
# Certificate "Hongkong Post Root CA 3"
# Certificate "Entrust Root Certification Authority - G4"
# Certificate "Microsoft ECC Root Certificate Authority 2017"
# Certificate "Microsoft RSA Root Certificate Authority 2017"
# Certificate "e-Szigno Root CA 2017"
# Certificate "certSIGN Root CA G2"
# Certificate "Trustwave Global Certification Authority"
# Certificate "Trustwave Global ECC P256 Certification Authority"
# Certificate "Trustwave Global ECC P384 Certification Authority"
# Certificate "NAVER Global Root Certification Authority"
# Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
# Certificate "GlobalSign Secure Mail Root R45"
# Certificate "GlobalSign Secure Mail Root E45"
# Certificate "GlobalSign Root R46"
# Certificate "GlobalSign Root E46"
# Certificate "GLOBALTRUST 2020"
# Certificate "ANF Secure Server Root CA"
# Certificate "Certum EC-384 CA"
# Certificate "Certum Trusted Root CA"
# Certificate "TunTrust Root CA"
# Certificate "HARICA TLS RSA Root CA 2021"
# Certificate "HARICA TLS ECC Root CA 2021"
# Certificate "HARICA Client RSA Root CA 2021"
# Certificate "HARICA Client ECC Root CA 2021"
# Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
# Certificate "vTrus ECC Root CA"
# Certificate "vTrus Root CA"
# Certificate "ISRG Root X2"
# Certificate "HiPKI Root CA - G1"
# Certificate "GlobalSign ECC Root CA - R4"
# Certificate "GTS Root R1"
# Certificate "GTS Root R2"
# Certificate "GTS Root R3"
# Certificate "GTS Root R4"
# Certificate "Telia Root CA v2"
# Certificate "D-TRUST BR Root CA 1 2020"
# Certificate "D-TRUST EV Root CA 1 2020"
# Certificate "DigiCert TLS ECC P384 Root G5"
# Certificate "DigiCert TLS RSA4096 Root G5"
# Certificate "DigiCert SMIME ECC P384 Root G5"
# Certificate "DigiCert SMIME RSA4096 Root G5"
# Certificate "Certainly Root R1"
# Certificate "Certainly Root E1"
# Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
# Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
# Certificate "Security Communication ECC RootCA1"
# Certificate "BJCA Global Root CA1"
# Certificate "BJCA Global Root CA2"
# Certificate "LAWtrust Root CA2 (4096)"
# Certificate "Sectigo Public Email Protection Root E46"
# Certificate "Sectigo Public Email Protection Root R46"
# Certificate "Sectigo Public Server Authentication Root E46"
# Certificate "Sectigo Public Server Authentication Root R46"
# Certificate "SSL.com TLS RSA Root CA 2022"
# Certificate "SSL.com TLS ECC Root CA 2022"
# Certificate "SSL.com Client ECC Root CA 2022"
# Certificate "SSL.com Client RSA Root CA 2022"
# Certificate "Atos TrustedRoot Root CA ECC G2 2020"
# Certificate "Atos TrustedRoot Root CA RSA G2 2020"
# Certificate "Atos TrustedRoot Root CA ECC TLS 2021"
# Certificate "Atos TrustedRoot Root CA RSA TLS 2021"
# Certificate "TrustAsia Global Root CA G3"
# Certificate "TrustAsia Global Root CA G4"
# Certificate "D-Trust SBR Root CA 1 2022"
# Certificate "D-Trust SBR Root CA 2 2022"
# Certificate "Telekom Security SMIME ECC Root 2021"
# Certificate "Telekom Security TLS ECC Root 2020"
# Certificate "Telekom Security SMIME RSA Root 2023"
# Certificate "Telekom Security TLS RSA Root 2023"
# Certificate "FIRMAPROFESIONAL CA ROOT-A WEB"
# Certificate "TWCA CYBER Root CA"
# Certificate "TWCA Global Root CA G2"
# Certificate "SecureSign Root CA12"
# Certificate "SecureSign Root CA14"
# Certificate "SecureSign Root CA15"
# Certificate "D-TRUST BR Root CA 2 2023"
# Certificate "TrustAsia SMIME ECC Root CA"
# Certificate "TrustAsia SMIME RSA Root CA"
# Certificate "TrustAsia TLS ECC Root CA"
# Certificate "TrustAsia TLS RSA Root CA"
# Certificate "D-TRUST EV Root CA 2 2023"
# Certificate "SwissSign RSA SMIME Root CA 2022 - 1"
# Certificate "SwissSign RSA TLS Root CA 2022 - 1"
# Certificate "OISTE Client Root ECC G1"
# Certificate "OISTE Client Root RSA G1"
# Certificate "OISTE Server Root ECC G1"
# Certificate " OISTE Server Root RSA G1"
- The following certificates were removed:
# Certificate "GlobalSign Root CA - R2"
# Certificate "Baltimore CyberTrust Root"
# Certificate "AddTrust Low-Value Services Root"
# Certificate "AddTrust External Root"
# Certificate "GeoTrust Global CA"
# Certificate "QuoVadis Root CA"
# Certificate "Security Communication Root CA"
# Certificate "Sonera Class 2 Root CA"
# Certificate "UTN USERFirst Email Root CA"
# Certificate "Camerfirma Chambers of Commerce Root"
# Certificate "Camerfirma Global Chambersign Root"
# Certificate "Certplus Class 2 Primary CA"
# Certificate "DST Root CA X3"
# Certificate "Deutsche Telekom Root CA 2"
# Certificate "Cybertrust Global Root"
# Certificate "Staat der Nederlanden Root CA - G2"
# Certificate "Hongkong Post Root CA 1"
# Certificate "Chambers of Commerce Root - 2008"
# Certificate "Global Chambersign Root - 2008"
# Certificate "Trustis FPS Root CA"
# Certificate "E-Tugra Certification Authority"
# Certificate "Staat der Nederlanden EV Root CA"
# Certificate "TrustCor RootCert CA-1"
# Certificate "TrustCor RootCert CA-2"
# Certificate "TrustCor ECA-1"
- mozilla\{certdata.h,nssckbi.h}: Update Mozilla certificate
authority bundle of the version 2.82.
- The following certificates were updated:
# Certificate "GlobalSign Root CA"
# Certificate "Entrust.net Premium 2048 Secure Server CA"
# Certificate "Comodo AAA Services root"
# Certificate "XRamp Global CA Root"
# Certificate "Go Daddy Class 2 CA"
# Certificate "Starfield Class 2 CA"
# Certificate "OISTE WISeKey Global Root GA CA"
# Certificate "certSIGN ROOT CA"
# Certificate "ACCVRAIZ1"
# Certificate "Staat der Nederlanden Root CA - G3"
# Certificate "OISTE WISeKey Global Root GC CA"
- The following certificates were added:
# Certificate "emSign Root CA - G1"
# Certificate "emSign ECC Root CA - G3"
# Certificate "emSign Root CA - C1"
# Certificate "emSign ECC Root CA - C3"
# Certificate "Hongkong Post Root CA 3"
# Certificate "Entrust Root Certification Authority - G4"
# Certificate "Microsoft ECC Root Certificate Authority 2017"
# Certificate "Microsoft RSA Root Certificate Authority 2017"
# Certificate "e-Szigno Root CA 2017"
# Certificate "certSIGN Root CA G2"
# Certificate "Trustwave Global Certification Authority"
# Certificate "Trustwave Global ECC P256 Certification Authority"
# Certificate "Trustwave Global ECC P384 Certification Authority"
# Certificate "NAVER Global Root Certification Authority"
# Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
# Certificate "GlobalSign Secure Mail Root R45"
# Certificate "GlobalSign Secure Mail Root E45"
# Certificate "GlobalSign Root R46"
# Certificate "GlobalSign Root E46"
# Certificate "GLOBALTRUST 2020"
# Certificate "ANF Secure Server Root CA"
# Certificate "Certum EC-384 CA"
# Certificate "Certum Trusted Root CA"
# Certificate "TunTrust Root CA"
# Certificate "HARICA TLS RSA Root CA 2021"
# Certificate "HARICA TLS ECC Root CA 2021"
# Certificate "HARICA Client RSA Root CA 2021"
# Certificate "HARICA Client ECC Root CA 2021"
# Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
# Certificate "vTrus ECC Root CA"
# Certificate "vTrus Root CA"
# Certificate "ISRG Root X2"
# Certificate "HiPKI Root CA - G1"
# Certificate "GlobalSign ECC Root CA - R4"
# Certificate "GTS Root R1"
# Certificate "GTS Root R2"
# Certificate "GTS Root R3"
# Certificate "GTS Root R4"
# Certificate "Telia Root CA v2"
# Certificate "D-TRUST BR Root CA 1 2020"
# Certificate "D-TRUST EV Root CA 1 2020"
# Certificate "DigiCert TLS ECC P384 Root G5"
# Certificate "DigiCert TLS RSA4096 Root G5"
# Certificate "DigiCert SMIME ECC P384 Root G5"
# Certificate "DigiCert SMIME RSA4096 Root G5"
# Certificate "Certainly Root R1"
# Certificate "Certainly Root E1"
# Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
# Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
# Certificate "Security Communication ECC RootCA1"
# Certificate "BJCA Global Root CA1"
# Certificate "BJCA Global Root CA2"
# Certificate "LAWtrust Root CA2 (4096)"
# Certificate "Sectigo Public Email Protection Root E46"
# Certificate "Sectigo Public Email Protection Root R46"
# Certificate "Sectigo Public Server Authentication Root E46"
# Certificate "Sectigo Public Server Authentication Root R46"
# Certificate "SSL.com TLS RSA Root CA 2022"
# Certificate "SSL.com TLS ECC Root CA 2022"
# Certificate "SSL.com Client ECC Root CA 2022"
# Certificate "SSL.com Client RSA Root CA 2022"
# Certificate "Atos TrustedRoot Root CA ECC G2 2020"
# Certificate "Atos TrustedRoot Root CA RSA G2 2020"
# Certificate "Atos TrustedRoot Root CA ECC TLS 2021"
# Certificate "Atos TrustedRoot Root CA RSA TLS 2021"
# Certificate "TrustAsia Global Root CA G3"
# Certificate "TrustAsia Global Root CA G4"
# Certificate "D-Trust SBR Root CA 1 2022"
# Certificate "D-Trust SBR Root CA 2 2022"
# Certificate "Telekom Security SMIME ECC Root 2021"
# Certificate "Telekom Security TLS ECC Root 2020"
# Certificate "Telekom Security SMIME RSA Root 2023"
# Certificate "Telekom Security TLS RSA Root 2023"
# Certificate "FIRMAPROFESIONAL CA ROOT-A WEB"
# Certificate "TWCA CYBER Root CA"
# Certificate "TWCA Global Root CA G2"
# Certificate "SecureSign Root CA12"
# Certificate "SecureSign Root CA14"
# Certificate "SecureSign Root CA15"
# Certificate "D-TRUST BR Root CA 2 2023"
# Certificate "TrustAsia SMIME ECC Root CA"
# Certificate "TrustAsia SMIME RSA Root CA"
# Certificate "TrustAsia TLS ECC Root CA"
# Certificate "TrustAsia TLS RSA Root CA"
# Certificate "D-TRUST EV Root CA 2 2023"
# Certificate "SwissSign RSA SMIME Root CA 2022 - 1"
# Certificate "SwissSign RSA TLS Root CA 2022 - 1"
# Certificate "OISTE Client Root ECC G1"
# Certificate "OISTE Client Root RSA G1"
# Certificate "OISTE Server Root ECC G1"
# Certificate " OISTE Server Root RSA G1"
- The following certificates were removed:
# Certificate "GlobalSign Root CA - R2"
# Certificate "Baltimore CyberTrust Root"
# Certificate "AddTrust Low-Value Services Root"
# Certificate "AddTrust External Root"
# Certificate "GeoTrust Global CA"
# Certificate "QuoVadis Root CA"
# Certificate "Security Communication Root CA"
# Certificate "Sonera Class 2 Root CA"
# Certificate "UTN USERFirst Email Root CA"
# Certificate "Camerfirma Chambers of Commerce Root"
# Certificate "Camerfirma Global Chambersign Root"
# Certificate "Certplus Class 2 Primary CA"
# Certificate "DST Root CA X3"
# Certificate "Deutsche Telekom Root CA 2"
# Certificate "Cybertrust Global Root"
# Certificate "Staat der Nederlanden Root CA - G2"
# Certificate "Hongkong Post Root CA 1"
# Certificate "Chambers of Commerce Root - 2008"
# Certificate "Global Chambersign Root - 2008"
# Certificate "Trustis FPS Root CA"
# Certificate "E-Tugra Certification Authority"
# Certificate "Staat der Nederlanden EV Root CA"
# Certificate "TrustCor RootCert CA-1"
# Certificate "TrustCor RootCert CA-2"
# Certificate "TrustCor ECA-1"
References
Timeline
Published14 Feb 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1771112524 · OSV
Track software like this
Free during beta